Who can connect.
WHAT TO USE
Key-based authentication, not passwords.
WHY
Passwords are guessed at scale, continuously.
WHAT TO DISABLE
Password authentication Direct login as the administrative account
WHAT TO PROVIDE INSTEAD
Individual accounts, with elevation when needed.
WHY INDIVIDUAL
Actions become attributable and access can be removed for one person.
WHAT TO RESTRICT
Which addresses may connect, where practical Which accounts may elevate
WHAT TO RECORD
Who has access to what, and why.
WHAT TO REVIEW
That list, quarterly.
WHAT TO DO WHEN SOMEONE LEAVES
Remove their key the same day Rotate any shared credential they knew
WHAT TO MONITOR
Successful and failed authentication attempts.
WHAT TO ALERT ON
Access at unexpected times or from unexpected places.
WHAT TO GIVE AUTOMATION
Its own key, limited to what it does.
WHAT TO ROTATE
Keys used by automation, periodically.
